HIPAA Notice of Privacy Practices

Effective Date and Who This Notice Applies To

This notice is effective September 23, 2026. It applies to Cherry Hills Support Services Corp and all of its staff, contractors, interns and volunteers, at 2851 S Parker Rd, Ste 640, Aurora, CO 80014 and wherever we provide services.

Protected health information means any information that identifies you and relates to your services, health, behavior, goals, assessments or payment for care, whether it is on paper, in an electronic system or spoken.

Your Rights at a Glance

You have the right to:

• Get a paper or electronic copy of your records
• Ask us to correct your records
• Ask us to contact you in a confidential way
• Ask us to limit the information we use or share
• Get a list of those with whom we have shared your information
• Get a copy of this notice
• Choose someone to act for you
• File a complaint if you believe your privacy rights have been violated

Your Rights in Detail

Get a Copy of Your Records

You may ask to see or get a paper or electronic copy of your records and other health information we have about you. Submit a written request that includes your name, date of birth, the records you want, your preferred format and your signature. We verify your identity before releasing records. We will provide a copy or a summary, usually within 30 days of your request. Any fee will be reasonable and cost-based, and we will tell you about it in advance. If we must deny part of a request for a legally permitted reason, we will explain why in writing and tell you how to ask for a review.

Ask Us to Correct Your Records

You may ask in writing for us to correct information you believe is incorrect or incomplete. If we agree, the correction is added to your record and the original entry is kept. We may say no, but we will tell you why in writing within 60 days.

Ask for Confidential Communications

You may ask us to contact you in a specific way, such as at a certain phone number, or to send mail to a different address. We will say yes to all reasonable requests.

Ask Us to Limit What We Use or Share

You may ask us not to use or share certain information for treatment, payment or our operations. We are not required to agree, and we may say no if it could affect your care. If we agree, we may still share the information if you need emergency treatment.

If you pay for a service in full out of pocket, you may ask us not to share information about that service with your health plan for payment or operations. We will say yes unless a law requires us to share it.

Get a List of Those With Whom We Have Shared Information

You may ask for a list of the times we have shared your health information in the six years before your request, who we shared it with and why. The list includes all disclosures except those for treatment, payment and operations and certain others, such as disclosures you asked us to make. We provide one list a year free of charge and may charge a reasonable, cost-based fee for another request within 12 months.

Get a Copy of This Notice

You may ask for a paper copy of this notice at any time, even if you agreed to receive it electronically. We will provide it promptly.

Choose Someone to Act for You

If someone is your legal guardian, holds your medical power of attorney or is otherwise your legally authorized representative, that person can exercise your rights and make choices about your health information. For a minor client, this is usually a parent or legal guardian. We confirm the person has this authority before we act.

Your Choices

For certain information, you can tell us what you want us to share. If you have a clear preference in the situations below, talk to us and we will follow your instructions. You may tell us to share or not share information:

• With family members, close friends or others involved in your care or in paying for your care
• In a disaster relief situation

If you cannot tell us your preference, for example if you are unconscious, we may share information if we believe it is in your best interest. We may also share information when needed to lessen a serious and imminent threat to health or safety.

We never share your information for these purposes unless you give us written permission:

• Marketing
• Sale of your information
• Most sharing of psychotherapy notes

If we ever contact you for fundraising, you may tell us not to contact you again. If we have substance use disorder records about you that are covered by 42 CFR Part 2, we will give you clear advance notice and a choice before using that information for fundraising.

How We Typically Use and Share Your Information

We use or share only the minimum information necessary for the purpose.

To Provide and Coordinate Your Services

Staff involved in your care may use your information, and we may share it with other professionals who are treating you. For example, we may coordinate with your primary care provider or another behavioral health provider.

To Run Our Organization

We may use and share information to manage services, improve care, conduct quality reviews and internal audits, train and supervise staff, meet licensing standards and contact you when necessary.

To Bill for Your Services

We may use and share information to bill and receive payment from Medicaid, your insurance plan or others responsible for payment.

Other Ways We May Use or Share Your Information

The law allows or requires us to share information in other ways, usually for the public good. We must meet the conditions in the law before sharing information for these purposes.

Public Health and Safety

• Preventing disease
• Reporting suspected abuse, neglect or exploitation of a child or an at-risk elder, as required by Colorado mandatory reporting laws
• Reporting suspected domestic violence where required by law
• Preventing or reducing a serious threat to anyone's health or safety

Research

We may use or share information for health research when the law allows.

Complying With the Law

We share information when state or federal law requires it, including with the U.S. Department of Health and Human Services if it asks to confirm we are complying with federal privacy law.

Medical Examiners and Funeral Directors

We may share information with a coroner, medical examiner or funeral director when a person dies.

Organ and Tissue Donation

We may share information with organ procurement organizations.

Workers' Compensation, Law Enforcement and Government Requests

• For workers' compensation claims
• For law enforcement purposes or with a law enforcement official, as the law allows
• With health oversight agencies, including those that license and inspect our services
• For special government functions such as military, national security and presidential protective services

Lawsuits and Legal Actions

We may share information in response to a court or administrative order, or in response to a subpoena, as the law allows.

Emergencies

When there is a risk of harm, we may share limited information with appropriate authorities. Every emergency disclosure is documented with the date, reason, information shared and recipient.

Substance Use Disorder Records

Records protected by 42 CFR Part 2 may have additional protections beyond those described in this notice. Where federal or Colorado law gives your mental health or substance use information stronger protection, we follow the stricter rule.

Uses That Require Your Written Authorization

We will not use or share your information in ways other than those described in this notice unless you tell us in writing that we can. A valid authorization names the specific information to be shared, the purpose, the recipient and an expiration date or event, and it includes your signature, the date and your right to revoke it.

You may change your mind at any time by telling us in writing, except to the extent we have already acted on your authorization.

Our Responsibilities

• We are required by law to maintain the privacy and security of your protected health information.
• We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.
• We must follow the duties and privacy practices described in this notice and give you a copy of it.
• We will not use or share your information other than as described here unless you tell us we can in writing.

To protect your information, we keep paper records locked, give each staff member an individual login with role-based access, lock screens automatically, hold conversations in private areas and train every workforce member in confidentiality before they work independently and every year after that.

Questions and Complaints

If you have questions about this notice, or believe your privacy rights have been violated, contact our Director of Compliance, who serves as our privacy official.

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, by writing to 200 Independence Avenue, S.W., Washington, D.C. 20201, by calling 1-877-696-6775, or online at hhs.gov/hipaa/filing-a-complaint.

We will not retaliate against you for filing a complaint.

Changes to This Notice

We can change the terms of this notice, and the changes will apply to all information we have about you. The new notice will be available on request, at our office and on this website.